HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

This Notice takes effect on February 16, 2026, and will remain in effect until we replace it.

For help to translate or understand this Notice of Privacy Practices, please call (256) 764-5761.

Matthew N. Wilbanks, D.M.D., P.C. is a Covered Entity as defined and regulated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  Matthew N. Wilbanks, D.M.D., P.C. is required by law to maintain the privacy of your protected health information (PHI), to provide individuals with notice of our legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information.  We must follow the privacy practices that are described in this Notice while it is in effect.

Matthew N. Wilbanks, D.M.D., P.C. reserves the right to change our privacy practices and this Notice at any time, provided such changes are permitted by applicable law, and to make the revised or changed Notice effective for all of your PHI that we already have.  We can also make it effective for any of your PHI we get in the future.  When we make a significant change in our privacy practices, we will change this Notice and post the new Notice clearly and prominently at our practice location, and we will provide copies of the new Notice upon request.

You may ask for a copy of our Notice of Privacy Practices at any time by using the contact information listed at the end of this Notice.  You may receive a paper copy of this Notice upon request, even if you have agreed to receive this Notice electronically.

USES AND DISCLOSURES OF YOUR PHI

We may use and disclose your health information for different purposes, including treatment, payment, and health care operations.  For each of these categories, we have provided a description and an example.  Some information, such as HIV-related information, genetic information, alcohol and/or substance abuse records, and mental health records may be entitled to special confidentiality protections under applicable state or federal law.  We will abide by these special protections as they pertain to applicable cases involving these types of records.

• Treatment.  We may use and disclose your PHI for your treatment and to coordinate your treatment among providers.  For example, we may disclose your PHI to a physician, dentist, specialist, or other healthcare provider providing treatment to you.

• Payment.  We may use and disclose your PHI to obtain reimbursement for the treatment and services you receive from us or another entity involved with your care.  Payment activities include billing, collections, claims management, and determinations of eligibility and coverage to obtain payment from you, an insurance company, or another third party.  For example, we may send claims to your health or dental plan containing your PHI.

• Healthcare Operations.  We may use and disclose your PHI in connection with our healthcare operations. For example, healthcare operations include providing customer services, responding to complaints and appeals, quality assessment and improvement activities, conducting training programs, and licensing activities.
  
  As part of our healthcare operations, we may disclose your PHI to our Business Associates that assist us in carrying out our healthcare operations.  We will have written agreements called “Business Associate Agreements” with our Business Associates to protect the privacy of your PHI to the extent required by HIPAA.

• Appointment Reminders/Treatment Alternatives.  We may use and disclose your PHI to remind you of an appointment for treatment and/or dental care with us.  We may also use or disclose it to remind you if you are past due for treatment.  In addition, we may use and disclose your PHI to give you information about treatment alternatives.

• Individuals Involved in Your Care or Payment for Your Care.  We may disclose your PHI to your family or friends or any other individual identified by you when they are involved in your care or in the payment for your care. Additionally, we may disclose information about you to a patient representative.  If a person has the authority by law to make health care decisions for you, we will treat that patient representative the same way we would treat you with respect to your PHI.

• Disaster Relief.  We may use or disclose your PHI to assist in disaster relief efforts.

• As Required by Law.  We may use or disclose your PHI when we are required to do so by federal, state, and/or local law.  The use or disclosure will be limited to the requirements of the law.  If multiple laws or regulations conflict, we will comply with the more restrictive laws or regulations.

• Public Health Activities.  We may disclose your PHI for public health activities, including disclosures to:

  • Prevent or control disease, injury or disability;

  • Report child abuse or neglect to a government authority authorized by law to receive such reports;

  • Report reactions to medications or problems with products or devices;

  • Notify a person of a recall, repair, or replacement of products or devices;

  • Notify a person who may have been exposed to a disease or condition;

  • Notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence; or

  • the Food and Drug Administration (FDA) to ensure the quality, safety, or effectiveness of products or services under the control of the FDA.

• National Security and Specialized Government Functions.  We may disclose to military authorities the PHI of Armed Forces personnel under certain circumstances. We may disclose to authorized federal officials the PHI required for lawful intelligence, counterintelligence, and other national security activities. We may disclose PHI to the Department of State for medical suitability determinations. We may disclose to a correctional institution, or law enforcement official having lawful custody, the PHI of an inmate or patient.  In addition, we may disclose your PHI for protective services of the President or other authorized persons.

• Secretary of HHS.  We will disclose your PHI to the Secretary of the U.S. Department of Health and Human Services when required to investigate or determine compliance with HIPAA.

• Worker’s Compensation.  We may disclose your PHI to the extent authorized by and to the extent necessary to comply with laws relating to worker’s compensation or other similar programs established by law. These are programs that provide benefits for work-related injuries or illness without regard to fault.

• Law Enforcement.  We may disclose your PHI for law enforcement purposes as permitted by HIPAA, as required by law, or in response to, for example, a court order, court-ordered warrant, subpoena, summons issued by a judicial officer, or a grand jury subpoena.  We may also disclose your relevant PHI to, for example, identify or locate a suspect, fugitive, material witness, or missing person.  We may also disclose PHI to law enforcement officials that we believe in good faith constitutes evidence of criminal conduct that occurred on our premises.

• Health Oversight Activities.  We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections, and credentialing, as necessary for licensure and for the government to monitor the health care system, government benefit programs, and compliance with civil rights laws.

• Judicial and Administrative Proceedings.  If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose PHI about you in response to an order of a court, an administrative tribunal, a subpoena, a summons, a warrant, a discovery request, or other lawful process instituted by someone else involved in the dispute, but only if efforts have been made, either by the requesting party or us, to tell you about the request or to obtain an order protecting the information requested.

• Research.  We may disclose your PHI to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information.

• Coroners, Medical Examiners, and Funeral Directors.  We may release your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death.  We may also disclose PHI to funeral directors consistent with applicable law to enable them to carry out their duties.

• Organ, Eye, and Tissue Donation.  We may disclose your PHI to organ procurement organizations.  We may also disclose your PHI to those who work in procurement, banking, or transplantation of cadaveric organs, eyes, and/or tissues.

• Fundraising. We may contact you to provide you with information about our sponsored activities, including fundraising programs, as permitted by applicable law.  If you do not wish to receive such information from us, you may opt out of receiving the communications.

• SUD Treatment Information.  If we receive or maintain any information about you from a substance use disorder (“SUD”) treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”), enhanced protections may apply to that information under federal law.  If we receive or maintain your Part 2 Program record through a general consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for purposes of treatment, payment or health care operations, we may use and disclose your Part 2 Program record in all manners allowed under HIPAA and other applicable law, including our treatment, payment and health care operations as described in this Notice.  However, if we receive or maintain your Part 2 Program record through specific consent you provide to the Part 2 Program, us, or another entity, we will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to us and as otherwise allowed under applicable law.
  
  In no event will we use or disclose your Part 2 Program record, or testimony relaying the content of such record(s), in any civil, criminal, administrative, or legislative proceedings against you by any Federal, State, or local authority, unless authorized by your written consent, or the order of a court after it provides you notice of the court order and an opportunity to be heard is provided to you or the holder of the record as provided in 42 CFR part 2.  A court order authorizing the use or disclosure of your Part 2 Program record must be accompanied by a subpoena or other legal requirement compelling disclosure prior to your Part 2 Program record being used or disclosed.

• Threats to Health and Safety.  We may use or disclose your PHI if we believe, in good faith, that it is needed to prevent or lessen a serious or imminent threat. This includes threats to the health or safety of a person or the public.

• Emergency Situations.  We may disclose your PHI in an emergency situation, or if you are unable to respond or not present. This includes disclosures to a family member, close personal friend, authorized disaster relief agency, or any other person you told us about. We will use professional judgment and experience to decide if the disclosure is in your best interests. If it is in your best interest, we will only disclose the PHI that is directly relevant to the person's involvement in your care.

• Victims of Abuse and Neglect.  We may disclose your PHI to a local, state, or federal government authority. This includes social services or a protective services agency authorized by law to have these reports. We will do this if we have a reasonable belief of abuse, neglect, or domestic violence.

Your written authorization is required, with a few exceptions, for the following reasons:

• Psychotherapy Notes.  We will request your written approval to use or disclose any of your psychotherapy notes that we may have on file, with limited exceptions (for example, for certain treatment, payment, or healthcare operations functions).

• Sale of PHI.  We will request your written approval before we make any disclosure that is deemed a sale of your PHI.  A sale of your PHI means we are getting paid for disclosing the PHI in this manner.

• Marketing.  We will request your written approval to use or disclose your PHI for marketing purposes, with limited exceptions (for example, when we have face-to face marketing communications with you, or when we give promotional gifts of nominal value.)

• Social Media.  We will request your written approval to use or disclose your PHI on social media.  We cannot post images and videos of you without your express, written, prior authorization.

We will also obtain your written authorization before using or disclosing your PHI for purposes other than those provided for in this Notice (or as otherwise permitted or required by law). You may revoke an authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your PHI, except to the extent that we have already taken action in reliance on the authorization. All other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization/consent. You may revoke your authorization/consent at any time, but your revocation must be made in writing. There are two cases when your revocation won’t take effect as soon as you request it:

1. When we have already taken action in reliance on your authorization/consent.

2. Before our office receives your written request of revocation.

Once we disclose your PHI as permitted by HIPAA or based on your written authorization, that information may be subject to redisclosure by the recipient and may no longer be protected by federal or state privacy laws, including HIPAA.

VERBAL AGREEMENT TO USE AND DISCLOSE YOUR PHI

We can take your verbal agreement to use and disclose your PHI to other people. This includes family members, close personal friends or any other person you identify. You can object to the use or disclosure of your PHI at the time of the request. You can give us your verbal agreement or objection in advance. You can also give it to us at the time of the use or disclosure. We will limit the use or disclosure of your PHI in these cases. We limit the information to what is directly relevant to that person’s involvement in your healthcare treatment or payment.

We can take your verbal agreement or objection to use and disclose your PHI in a disaster situation. We can give it to an authorized disaster relief entity. We will limit the use or disclosure of your PHI in these cases. It will be limited to notifying a family member, personal representative or other person responsible for your care of your location and general condition. You can give us your verbal agreement or objection in advance. You can also give it to us at the time of the use or disclosure of your PHI.

YOUR RIGHTS

The following are your rights concerning your PHI. If you would like to use any of the following rights, please contact us. Our contact information is at the end of this Notice.

• Right to Access and Receive a Copy of your PHI.  You have the right to look at or get copies of your PHI contained in a designated record set, with limited exceptions. If you request information that we maintain on paper, we may provide photocopies. If you request information that we maintain electronically, you have the right to an electronic copy. We will use the form and format you request if readily producible. We may charge you a reasonable, cost-based fee for the cost of supplies and labor of copying, and for postage if you want copies mailed to you. Contact us using the information listed at the end of this Notice for an explanation of our fee structure.
  
  You must make your request in writing. You may obtain a form to request access to your PHI by using the contact information listed at the end of this Notice. You may also request access by sending us a letter to the address at the end of this Notice. If you are denied a request for access, you have the right to have the denial reviewed in accordance with the requirements of applicable law. If we deny your request, we will give you a written explanation. We will tell you if the reasons for the denial can be reviewed. We will also let you know how to ask for a review, or if the denial cannot be reviewed.

• Right to Receive an Accounting of Disclosures.  With the exception of certain disclosures made for the purposes of treatment, payment, healthcare operations, or disclosures that you authorized and certain other activities, you have the right to receive a list of the times, within the last six years, in which we disclosed your PHI. To request an accounting of disclosures of your PHI, you must submit your request in writing to our Privacy Official. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to the additional requests. We will give you more information on our fees at the time of your request.

• Right to Request That We Change your PHI.  You have the right to ask that we change your PHI if you believe it has wrong information. You must ask for such changes in writing. You must explain why the information should be changed. We may deny your request for certain reasons. For example, if we did not create the information you want changed and the creator of the PHI is able to perform the change. If we deny your request, we will provide you with a written explanation within 60 days.  You may respond with a statement that you disagree with our decision. We will attach your statement to the PHI you ask that we change. If we accept your request to change the information, we will make reasonable efforts to inform others of the change. This includes people you name. We will also make the effort to include the changes in any future disclosures of that information.

• Right to Request a Restriction.  You have the right to ask for restrictions on the use and disclosure of your PHI for treatment, payment, or healthcare operations by submitting a written request to our Privacy Official. You can also ask for a restriction of disclosures to persons involved in your care or payment of your care, including family members or close friends. Your written request must include (1) what information you want to limit, (2) whether you want to limit our use, disclosure or both, and (3) to whom you want the limits to apply. We are not required to agree to your request. We will not comply with your restriction if the information is needed to provide you with emergency treatment. However, we will restrict the use or disclosure of PHI to a health plan for the purposes of payment and health care operations, when you have paid for the service or item out-of-pocket in full, except as prohibited by law.

• Right to Request Confidential Communications.  You have the right to ask that we communicate with you about your PHI by alternative means or at alternative locations. You must make your request in writing. You do not have to explain the reason for your request; however, you must state that the information could endanger you if the change is not made. Your request must specify the alternative means or location, and provide satisfactory explanation of how payments will be handled under the alternative means or location you request. We must work with your request if it is reasonable, and states the other means/locations where we should communicate with you about your PHI.

• Right to Notification of a Breach. You will receive notifications of breaches of your unsecured PHI as required by law.

• Right to File a Complaint.  If you feel your privacy rights have been violated or that we have violated our own privacy practices, you can file a complaint with us. You can also do this by phone. Use the contact information at the end of this Notice. You can also submit a written complaint to the U.S. Department of Health and Human Services (HHS). See the contact information on the HHS website at www.hhs.gov/ocr. If you request, we will provide you with the address to file a written complaint with HHS.  WE WILL NOT TAKE ANY ACTION AGAINST YOU FOR FILING A COMPLAINT.

• Right to Receive a Copy of this Notice.  You may ask for a copy of our Notice of Privacy Practices at any time by using the contact information listed at the end of this Notice. You may receive a paper copy of this Notice upon request, even if you have agreed to receive this Notice electronically.

CONTACT INFORMATION

If you have any questions about this Notice, our privacy practices related to your PHI, or how to exercise your rights, you can contact us in writing.  You may also contact us by phone.  Use the contact information listed below.

  Matthew N. Wilbanks, D.M.D., P.C.
  Attention:  Privacy Official
2801 West Mall Drive
Florence, Alabama 35630
Phone: 256-764-5761 Fax: 256-764-2506

       Email:  wilbanksdental@wilbanksdental.com

You may also file a complaint with the U.S. Department of Health and Human Services (HHS), Office of Civil Rights (OCR).

    U.S. Department of Health and Human Services Office for Civil Rights 

200 Independence Avenue, S.W.
Washington, DC 20201
Phone:  1-877-696-6775
Web: https://www.hhs.gov/hipaa/filing-a-complaint/index.html